REMARKS 



Reconsideration and allowance of the claims are requested in view of the above the 
amendments and following remarks. Claims 1, 5, 13 and 24 have been amended. Claims 1-3, 
and 5-6 are pending in the present application, with claims 1, 13 and 24 being independent. 

Double Patenting 

The Office Action has provisionally rejected claims 1-36 on the ground of non-statutory 
obviousness-type double patenting as being unpatentable over claims in co-pending US. Patent 
Applications No. 10/690,422, 10/849,090, and 10/994,010. Applicants intend to file a terminal 
disclaimer when the double patenting rejection becomes final and when the claims of the present 
application are allowed. 

Rejections Under 35 U.S.C. S103 

The Office Action rejects Claims 1-3, 5, 8-10, 13-16, 19-21, 24-27, 30-32, 35 and 36 
under 35 U.S.C. § 103(a) as purportedly being unpatentable over U.S. Patent No. 7,346,700 to 
Gould et al. (hereinafter "Gow/d") in view of U.S. Publication No. 20050015455 to Liu 
(hereinafter "Liu"). Applicant respectfully traverses the rejection. 

Gould fails to disclose or suggest a packet sniffer configured to check a fragment offset 
field and likewise fails to determine the value of a SYN bit in a TCP header, as variously 
encompassed by the claims. Instead, Gould discloses determining only the IP address from an 
IP packet header. Furthermore, Gould makes no mention of a fragment offset field of an IP 
header or of determining the value of a SYN bit. Liu does not cure the deficiencies of Gould 
because Liu discloses a SPAM filter that strips the sender's e-mail address, information on the 
"subject" line field, the time the e-mail was sent, information regarding the number of recipients 
and information regarding the list of recipients from the input e-mail message and generates a 
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check sender request. The check sender request is sent to a data center and used to determine if 
the e-mail message is spam. (See Figs. 1 and 4, and paragraphs 0063, 0064). However, 
Applicants note that Liu also makes no mention of checking a fragment offset field of an IP 
header or determining the value of a SYN bit in a TCP header and disregarding the packet if the 
SYN bit has not been set, as variously encompassed by the claims. Accordingly, neither Gould 
nor Liu, separately or in combination teach or suggest, "a plurality of packet sniffers, each of 
which is located on a unique one of the plurality of servers, such that each of a plurality of 
packet sniffers are configured to; a) check a fragment offset field of an IP header to ensure the 
IP header is the first fragment of a packet, b) determine the value of a SYN bit in a TCP 
header, c) disregarding the packet if the SYN bit has not been set, and d) extract originating 
IP addresses associated with e-mail messages that are communicated to clients by the server; " 
as recited in independent Claim 1 and similar features recited in independent Claims 13 and 
Claim 24. 

Claims 2-3, 5 and 8-10 depend from independent Claim 1. Dependent Claims 2-3, 5 and 
8-10 are likewise allowable for at least the same reasons as independent Claim 1, and are 
variously allowable for the same reasons. Claims 14-16 and 19-21 depend from independent 
Claim 13. Dependent Claims 14-16 and 19-21 are likewise allowable for at least the same 
reasons as independent Claim 13, and are variously allowable for the same reasons. Claims 25- 
27, 30-32 and 35-36 depend from independent Claim 24. Dependent Claims 25-27, 30-32 and 
35-36 are likewise allowable for at least the same reasons as independent Claim 24. 

The Office Action rejects Claims 6, 7, 17, 18, 33 and 34 as being rejected under 35 USC 
§ 103(a) as being purportedly unpatentable over Gould in view of Liu in further of U.S. Patent 
No. 7,1 17,358 to Bandini (hereinafter "Bandini"). Applicants respectfully traverse the rejection. 

In particular, Bandini fails to disclose or suggest a packet sniffer being configured to 
check a fragment offset field of an IP header and determine the value of a SYN bit in a TCP 
header and disregarding the packet if the SYN bit has not been set, as variously encompassed by 
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the present claims. Instead, Bandini discloses using sender information, recipient group and/or 
attachment type of the received e-mail to determine a comparison score. The comparison score 
is compared with a threshold to determine if the received email message is classified as SPAM. 
(See Col. 3, lines 36-66). Furthermore, Bandini makes no mention of a fragment offset field of 
an IP header or determining the value of a SYN bit. Accordingly, Gould, Liu and Bandini either 
separately or in combination fail to teach or suggest, "a plurality of packet sniffers, each of which 
is located on a unique one of the plurality of servers, such that each of a plurality of packet 
sniffers are configured to; a) check a fragment offset field of an IP header to ensure the IP 
header is the first fragment of a packet, b) determine the value of a SYN bit in a TCP header, 
c) disregarding the packet if the SYN bit has not been set, and d) extract originating IP 
addresses associated with e-mail messages that are communicated to clients by the server;, " as 
recited in independent Claims 1,13 and 24, from which Claims 6, 7, 17, 18, 33 and 34 depend. 

The Office Action rejects Claims 11, 12, 22, 23, 28 and 29 as being rejected under 35 
USC § 103(a) as being purportedly unpatentable over Gould in view of Liu in further of U.S. 
Publication No. 20030109248 to Lewis (hereinafter "Lewis"). Applicants respectfully traverse 
the rejection. 

In particular, Lewis fails to disclose or suggest a packet sniffer being configured to check 
a fragment offset field of an IP header and determine the value of a SYN bit in a TCP header and 
disregarding the packet if the SYN bit has not been set, as variously encompassed by the present 
claims. Instead, Lewis discloses a mail transfer gateway (MTA) which maintains a list of regular 
expressions that are commonly found in SPAM messages, as well as, using a checksum or a 
counter for verifying the text of an e-mail for "spamming" language. See paragraphs 296-297. 
Lewis makes no mention of a fragment offset field of an IP header or determining the value of a 
SYN bit. Accordingly, the combination of Gould, Liu and Lewis either separately or in 
combination teach or suggest fail to disclose, "wherein each packet sniffer in the plurality of 
packet sniffers is configured to check a fragment offset field of an IP header to ensure the IP 

header is the first fragment of a packet and determine the value of a SYN bit in a TCP header 
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and disregarding the packet if the SYN bit has not been set, and extract from the received 
packet originating IP addresses associated with e-mail messages that are communicated to the 
clients over the distributed network, " as recited in independent Claims 1,13 and 24, from which 
Claims 1 1, 12, 22, 23, 28 and 29 depend. 



Conclusion 

Accordingly, in view of the above amendments and remarks it is submitted that the 
claims are patcntably distinct over the prior art cited and that all the rejections to the claims have 
been overcome. Based on the foregoing, Applicants respectfully request that the pending claims 
be allowed, and that a timely Notice of Allowance be issued in this case. If the Examiner 
believes, after this amendment, that the application is not in condition for allowance, the 
Examiner is requested to call the Applicants' attorney at the telephone number listed below. 
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If this response is not considered timely filed and if a request for an extension of time is 
otherwise absent, applicants hereby request any necessary extension of time. If there is a fee 
occasioned by this response, including an extension fee that is not covered by an enclosed check 
please charge any deficiency to Deposit Account No. 50-0463. 



Respectfully submitted, 
Microsoft Corporation 



Date: October 17. 2008 By: /Bryan E. Webster/ 

Bryan E Webster, Reg. No.: 47,214 

Attorney for Applicants 

Direct telephone: (425) 538-2731 

Microsoft Corporation 

One Microsoft Way 

Redmond WA 98052-6399 



CERTIFICATE OF MAILING OR TRANSMISSION 
(Under 37 CFR § 1.8(a)) or ELECTRONIC FILING 

I hereby certify that this correspondence is being electronically deposited with the USPTO via 
EFS-Web on the date shown below: 

October 17, 2008 /Noemi Tovar/ 

Date Noemi Tovar 
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